exec: PE32+ loader, versioned ABI, first external binaries (v0.6.0)

rsapi: the kernel<->binary ABI crate (no_std, no deps).  Versioned
Exports table (magic + version header), EntryPoint = extern "C" on
x86_64-unknown-uefi (Win64: RCX/RDX/R8), Line/Arg/StreamResult types.
Binaries link only this crate.

rsnix::load: PE32+ parser — DOS/COFF/optional headers, section copy,
BSS zero-fill, .reloc base relocations (DIR64) via rva_to_file mapping
(the reloc directory is an RVA, not a file offset).  Images are
allocated at LOAD_BASE=192MiB inside the page allocator's conventional
span and identity-mapped user+writable+nx.

rsnix::exec: resolution name -> /disk/<UID>/bin/<kind>/<name>.efi per
mounted volume; spawn reserves a sched slot, stores a per-task ExecCtx
(exports + argv block + image) before launch_at installs the frame —
no adopt race.  Trampoline calls entry(&Exports, argc, argv), posts
TaskMsg::User(exit_code) to the shell.  abort_current notifies the
shell with u64::MAX when an exec'd binary dies, so a faulting command
cannot leave the shell blocked forever.

sched: reserve_slot/launch_at split out of spawn; task_exit made pub.

shell: exec_external runs before non-frozen built-ins (ADR 0006
resolution rule); frozen core (help/clear/echo/halt/poweroff/exit/
rescan) is exempt.  Exports v1 wires put_line to the terminal and
get_line to EOF; stream injection lands in Phase 3.  ^C while waiting
kills the command task.

bins/{hello,boom}: gate binaries.  hello prints through the exports
table; boom faults on 0x400000000000 to prove containment.  The image
entry point IS the ABI entry (efi_main carries the Exports signature).

Version 0.6.0: exec exists end-to-end.

Gates verified in QEMU: 'hello' loads from \\bin\\cli\\hello.efi, calls
put_line across the ABI, exits 0, shell unblocks; 'boom' faults, task
dies gracefully with full report, shell survives, jobs shows the corpse;
built-in fallback works when the file is absent; test-disk PASS.

2 files changed, 41 insertions, 0 deletions

diff --git a/bins/boom/Cargo.toml b/bins/boom/Cargo.toml
new file mode 100644
index 0000000..2d31886
--- /dev/null
+++ b/bins/boom/Cargo.toml
@@ -0,0 +1,10 @@
+[package]
+name = "boom"
+version.workspace = true
+edition.workspace = true
+
+[lints]
+workspace = true
+
+[dependencies]
+rsapi = { path = "../../rsapi" }
diff --git a/bins/boom/src/main.rs b/bins/boom/src/main.rs
new file mode 100644
index 0000000..0c3201b
--- /dev/null
+++ b/bins/boom/src/main.rs
@@ -0,0 +1,31 @@
+//! boom — crash-containment probe (ADR 0006 Phase 2 gate).
+//!
+//! Deliberately faults on an unmapped address.  The kernel must kill only
+//! this task; the shell survives and `jobs` shows the corpse.
+
+#![no_std]
+#![no_main]
+
+#[panic_handler]
+fn panic(_info: &core::panic::PanicInfo) -> ! {
+    loop {
+        core::hint::spin_loop();
+    }
+}
+
+/// The image entry point — the loader jumps here with the ABI arguments.
+#[unsafe(no_mangle)]
+pub extern "C" fn efi_main(
+    _exports: &'static rsapi::Exports,
+    _argc: usize,
+    _argv: *const rsapi::Arg,
+) -> i32 {
+    // Canonical-but-unmapped address (below 2^47, above any RAM/MMIO):
+    // the page walk terminates at a not-present entry → #PF with
+    // CR2 = address.  Same trick as the built-in `fault` command.
+    unsafe {
+        let p = 0x4000_0000_0000usize as *mut u64;
+        p.write_volatile(0xDEAD_BEEF);
+    }
+    0
+}